iOS 13 Will Finally Support NFC ID Scanning

The interior ministry of Germany has announced that Apple's update to its smartphone operating system, iOS 13, will allow iPhone users to scan National ID cards, residence permits, and biometric passports onto their smartphones. Likely coming in September, iOS 13 will provide a mobile companion to physical documents for German citizens by supporting the German government’s AusweisApp2. This functionality will also be available to citizens in Japan. Outside of Germany and Japan, the U.K. government’s Near-Field Communications (NFC) passport reader app, ReadID, will also work on the iPhone as a result of the iOS 13 update. This means that the iPhone (and smartphones in general) may begin to play a larger role in citizen identity and other Original Equipment Manufacturers (OEMs) may choose to follow suit.

Originally, the iPhone’s NFC reader only supported the data format for contactless payment cards, andNFC functionality was limited to Apple Pay transactions to facilitate increased financial security. It could have been adapted for credential scanning, but Apple did not release the necessary upgrade. As part of iOS 11, Apple added the Core NFC framework, which permitted third-party app developers to read NFC Data Exchange Format (NDEF) data from NFC tags 1 to 5 only. With iOS 13, the restriction is being removed to allow the reading of any NFC chip data format. Also, apps will be able to write directly to blank tags, as well as interact with tags through native protocols. This is permitted due to Core NFC framework supporting tag reading and writing across various formats, including not only NFC NDEF tags, but also Mifare, FeliCa, ISO 7816 (e.g. for passports), and ISO 15693. While Apple will still look to approve the apps that may be developed as a result of this on a case-by-case basis, it is likely that a wide range of third-party document scanning solutions will be approved and that any country that desires to offer this capability to its citizens will be able to do so unhindered by technological limitations.

Android devices have had the capability to read all NFC tags for a number of years, but now that Apple has expanded its NFC functionality there will be a wider uptake with the vast majority of the smartphone market now covered.

However, just because the functionality to offer the identity solution is there, that does not mean it will find widespread use among a population. In the case of Germany, the privacy and protection of one’s identity and data are paramount, and citizens may not be willing to store ID cards on an iPhone. Furthermore, the localized storage of the mobile credential will remain only a companion to the physical document, which will continue to be issued and used in the event the mobile device is lost or left behind. The solution to scan My Number ID cards onto iPhones will likely see a larger take-up in Japan, however, where, according to ABI Research’s Mobile Devices, Features, and Technologies (MD-MDEV-106) Market Data, iPhones made up 35.4% of all smartphones shipped in 2018.  

As mentioned in ABI Research’s Mobile Identities and Derived Credentials (AN-5137) Application Analysis Report, any solution that incorporates a mobile component will experience a number of market inhibitors inherent to mobile identities, such as:

• Previously, citizen credentials have been a system owned and managed by the government. With mobile credentials, governments will be required to rely on handset devices that are already in circulation, operate on different Operating Systems (OSs), and have varying hardware components to leverage from a security standpoint.
• With a mobile credential program, there will be several stakeholders that will likely have different interests and priorities as to what they will want to see incorporated within the solution. A mobile OEM, such as Apple or Samsung, will place emphasis on profit margins and maintaining control over their handsets, while also protecting customer information as part of an obligation to data confidentiality. Conversely, governments will place a priority on securing their citizen's data and safeguarding against fraud.
• The physical document market is already well ingrained with trust originating from a combination of the physical (holograms, guilloche lines, laser engraving) and the digital (cryptographic algorithms), which helps bind the identity to a physical form factor. This is being increasingly supported by biometric information and provides layers of multi-factor authentication. Mobile identity solutions will have to integrate with the document market and build trust in the population to ensure enrollment is as widely spread as possible.
• Any credential that is stored on either a mobile device or a backend server must be available in offline mode without connectivity to the Internet or a mobile network. If law enforcement requests to see a driver’s license as part of a routine check, the credential must be able to be viewed by the officer even in areas with no connectivity.

It seems that, while this announcement is a positive outcome for the market of mobile identities, it will still retain the pitfalls that are part and parcel of any mobile identity solution. In the future, it may be the case that offline functionality and remote revocation of stolen or illegitimate credentials becomes standard practice for mobile identities, which could result in mobile-only documents. However, until these criteria are met, the smart card will remain the dominant form factor in the Government ID arena.